Vulnerability · Published Jul 18, 2025 · Assigned by Mattermost
CVE-2025-6226IDOR in CreatePost API allows for timeboxed message disclosure
Medium 6.5
In plain English
A medium-severity missing authentication in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | 9.11.17 | GHSA-7h34-9chr-58qh |
| Go | github.com/mattermost/mattermost-server | 10.5.7 | GHSA-7h34-9chr-58qh |
| Go | github.com/mattermost/mattermost-server | 10.7.4 | GHSA-7h34-9chr-58qh |
| Go | github.com/mattermost/mattermost-server | 10.8.2 | GHSA-7h34-9chr-58qh |
| Go | github.com/mattermost/mattermost-server | 10.5.7+incompatible, 10.7.4+incompatible, 10.8.2+incompatible, 9.11.17+incompatible | GO-2025-3819 |
| Go | github.com/mattermost/mattermost-server/v5 | no fix listed | GO-2025-3819 |
| Go | github.com/mattermost/mattermost-server/v6 | no fix listed | GO-2025-3819 |
| Go | github.com/mattermost/mattermost/server/v8 | 8.0.0-20250520130510-fa40a8c5d47f | GO-2025-3819 |
| Go | github.com/mattermost/mattermost/server/v8 | 8.0.0-20250520130510-fa40a8c5d47f | GHSA-7h34-9chr-58qh |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mattermost | Mattermost | 10.5.0 – through 10.5.610.8.0 – through 10.8.110.7.0 – through 10.7.39.11.0 – through 9.11.16 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N